Ensure all HTTP Header Logging options are enabled

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón

(?m)(?:^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-xff yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-referer yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-http-hdr-user-agent yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles url-filtering (?:"[^"\n]*"|\S+) log-container-page-only no[ \t]*$)

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

configure set profiles url-filtering <profile> log-container-page-only no set profiles url-filtering <profile> log-http-hdr-user-agent yes set profiles url-filtering <profile> log-http-hdr-referer yes set profiles url-filtering <profile> log-http-hdr-xff yes commit # CIS guidance: Navigate to Objects > Security Profiles > URL Filtering > URL Filtering Profile > URL Filtering Settings. Set the following four settings: a. Log container page only box is un-checked b. Check the User-Agent box c. Check the Referer box d. Check the X-Forwarded-For box

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target paloalto